openstack/kuryr-kubernetes
Code Issues Proposed changes

Skip exception in case kuryrnetpolicy CRD is already deleted

Browse Source 
As kuryrnetpolicy CRD objects are namespaced, when a namespace is
deleted, the object is deleted by kubernetes as part of the namespace
deletion process. This was making network policy driver failing on
releasing the network policy as it could not find the object. This
patch ensures kuryr-controller doesn't fail in case kubernetes has
already deleted the kuryrnetpolicy object by skipping the exception
when trying to delete an already deleted object.

Closes-Bug: 1816020
Change-Id: I0443b65e5d6897c5d6673c222fc50101c244cd1e
This commit is contained in:
Luis Tomas Bolivar 2019-02-15 10:24:42 +01:00
parent d8c04167e4
commit 6c0730fda4
7 changed files with 99 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.zuul.d/octavia.yaml
View File

@ -123,7 +123,7 @@
vars:
tempest_test_regex: '^(kuryr_tempest_plugin.tests.scenario.test_network_policy.TestNetworkPolicyScenario)'
devstack_localrc:
KURYR_ENABLED_HANDLERS: vif,lb,lbaasspec,namespace,pod_label,policy
KURYR_ENABLED_HANDLERS: vif,lb,lbaasspec,namespace,pod_label,policy,kuryrnetpolicy
KURYR_SG_DRIVER: policy
KURYR_SUBNET_DRIVER: namespace
voting: false

2
doc/source/installation/network_policy.rst
View File

@ -7,7 +7,7 @@ handlers at kuryr.conf (further info on how to do this can be found at
:doc:`./devstack/containerized`)::
[kubernetes]
enabled_handlers=vif,lb,lbaasspec,policy,pod_label,namespace
enabled_handlers=vif,lb,lbaasspec,policy,pod_label,namespace,kuryrnetpolicy
After that, enable also the security group drivers for policies::

33
kuryr_kubernetes/controller/drivers/network_policy.py
View File

@ -370,22 +370,24 @@ class NetworkPolicyDriver(base.NetworkPolicyDriver):
return ingress_sg_rule_body_list, egress_sg_rule_body_list
def delete_np_sg(self, sg_id):
try:
self.neutron.delete_security_group(sg_id)
except n_exc.NotFound:
LOG.debug("Security Group not found: %s", sg_id)
except n_exc.Conflict:
LOG.debug("Security Group already in use: %s", sg_id)
# raising ResourceNotReady to retry this action in case ports
# associated to affected pods are not updated on time, i.e.,
# they are still using the security group to be removed
raise exceptions.ResourceNotReady(sg_id)
except n_exc.NeutronClientException:
LOG.exception("Error deleting security group %s.", sg_id)
raise
def release_network_policy(self, netpolicy_crd):
if netpolicy_crd is not None:
try:
sg_id = netpolicy_crd['spec']['securityGroupId']
self.neutron.delete_security_group(sg_id)
except n_exc.NotFound:
LOG.debug("Security Group not found: %s", sg_id)
except n_exc.Conflict:
LOG.debug("Security Group already in use: %s", sg_id)
# raising ResourceNotReady to retry this action in case ports
# associated to affected pods are not updated on time, i.e.,
# they are still using the security group to be removed
raise exceptions.ResourceNotReady(sg_id)
except n_exc.NeutronClientException:
LOG.exception("Error deleting security group %s.", sg_id)
raise
self.delete_np_sg(netpolicy_crd['spec']['securityGroupId'])
self._del_kuryrnetpolicy_crd(
netpolicy_crd['metadata']['name'],
netpolicy_crd['metadata']['namespace'])
@ -470,6 +472,9 @@ class NetworkPolicyDriver(base.NetworkPolicyDriver):
LOG.exception("Kubernetes Client Exception deleting kuryrnetpolicy"
" CRD.")
raise
except n_exc.NotFound:
LOG.debug("KuryrNetPolicy CRD Object not found: %s",
netpolicy_crd_name)
def affected_pods(self, policy, selector=None):
if selector:

37
kuryr_kubernetes/controller/handlers/kuryrnetpolicy.py Normal file
View File

@ -0,0 +1,37 @@
# Copyright 2019 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
from kuryr_kubernetes import constants
from kuryr_kubernetes.controller.drivers import base as drivers
from kuryr_kubernetes.handlers import k8s_base
class KuryrNetPolicyHandler(k8s_base.ResourceEventHandler):
"""Controller side of KuryrNetPolicy process for Kubernetes pods.
`KuryrNetPolicyHandler` runs on the Kuryr-Kubernetes controller and is
responsible for deleting associated security groups upon namespace
deletion.
"""
OBJECT_KIND = constants.K8S_OBJ_KURYRNETPOLICY
OBJECT_WATCH_PATH = constants.K8S_API_CRD_KURYRNETPOLICIES
def __init__(self):
super(KuryrNetPolicyHandler, self).__init__()
self._drv_policy = drivers.NetworkPolicyDriver.get_instance()
def on_deleted(self, netpolicy_crd):
crd_sg = netpolicy_crd['spec'].get('securityGroupId')
if crd_sg:
self._drv_policy.delete_np_sg(crd_sg)

44
kuryr_kubernetes/controller/handlers/policy.py
View File

@ -96,29 +96,33 @@ class NetworkPolicyHandler(k8s_base.ResourceEventHandler):
project_id = self._drv_project.get_project(policy)
pods_to_update = self._drv_policy.affected_pods(policy)
netpolicy_crd = self._drv_policy.get_kuryrnetpolicy_crd(policy)
crd_sg = netpolicy_crd['spec'].get('securityGroupId')
for pod in pods_to_update:
if driver_utils.is_host_network(pod):
continue
pod_sgs = self._drv_pod_sg.get_security_groups(pod, project_id)
if crd_sg in pod_sgs:
pod_sgs.remove(crd_sg)
if not pod_sgs:
pod_sgs = oslo_cfg.CONF.neutron_defaults.pod_security_groups
if netpolicy_crd:
crd_sg = netpolicy_crd['spec'].get('securityGroupId')
for pod in pods_to_update:
if driver_utils.is_host_network(pod):
continue
pod_sgs = self._drv_pod_sg.get_security_groups(pod,
project_id)
if crd_sg in pod_sgs:
pod_sgs.remove(crd_sg)
if not pod_sgs:
raise oslo_cfg.RequiredOptError('pod_security_groups',
oslo_cfg.OptGroup(
'neutron_defaults'))
self._drv_vif_pool.update_vif_sgs(pod, pod_sgs)
pod_sgs = (
oslo_cfg.CONF.neutron_defaults.pod_security_groups)
if not pod_sgs:
raise oslo_cfg.RequiredOptError(
'pod_security_groups',
oslo_cfg.OptGroup('neutron_defaults'))
self._drv_vif_pool.update_vif_sgs(pod, pod_sgs)
self._drv_policy.release_network_policy(netpolicy_crd)
self._drv_policy.release_network_policy(netpolicy_crd)
services = self._get_services(policy['metadata']['namespace'])
for service in services.get('items'):
if service['metadata']['name'] == 'kubernetes':
continue
sgs = self._drv_svc_sg.get_security_groups(service, project_id)
self._drv_lbaas.update_lbaas_sg(service, sgs)
services = self._get_services(policy['metadata']['namespace'])
for service in services.get('items'):
if service['metadata']['name'] == 'kubernetes':
continue
sgs = self._drv_svc_sg.get_security_groups(service,
project_id)
self._drv_lbaas.update_lbaas_sg(service, sgs)
def is_ready(self, quota):
if not utils.has_kuryr_crd(k_const.K8S_API_CRD_KURYRNETPOLICIES):

16
kuryr_kubernetes/tests/unit/controller/drivers/test_network_policy.py
View File

@ -96,6 +96,7 @@ class TestNetworkPolicyDriver(test_base.TestCase):
self._crd = {
'metadata': {'name': mock.sentinel.name,
'namespace': u'default',
'selfLink': mock.sentinel.selfLink},
'spec': {
'egressSgRules': [
@ -440,3 +441,18 @@ class TestNetworkPolicyDriver(test_base.TestCase):
resp = self._driver.namespaced_pods(self._policy)
self.assertEqual([], resp)
@mock.patch.object(network_policy.NetworkPolicyDriver,
'_del_kuryrnetpolicy_crd', return_value=False)
def test_release_network_policy(self, m_del_crd):
self._driver.release_network_policy(self._crd)
self.neutron.delete_security_group.assert_called_once_with(
self._crd['spec']['securityGroupId'])
m_del_crd.assert_called_once_with(self._crd['metadata']['name'],
self._crd['metadata']['namespace'])
@mock.patch.object(network_policy.NetworkPolicyDriver,
'_del_kuryrnetpolicy_crd', return_value=False)
def test_release_network_policy_removed_crd(self, m_del_crd):
self._driver.release_network_policy(None)
m_del_crd.assert_not_called()

1
setup.cfg
View File

@ -103,6 +103,7 @@ kuryr_kubernetes.controller.handlers =
ocproute = kuryr_kubernetes.platform.ocp.controller.handlers.route:OcpRouteHandler
policy = kuryr_kubernetes.controller.handlers.policy:NetworkPolicyHandler
pod_label = kuryr_kubernetes.controller.handlers.pod_label:PodLabelHandler
kuryrnetpolicy = kuryr_kubernetes.controller.handlers.kuryrnetpolicy:KuryrNetPolicyHandler
test_handler = kuryr_kubernetes.tests.unit.controller.handlers.test_fake_handler:TestHandler
kuryr_kubernetes.controller.drivers.multi_vif =